<div dir="ltr">Hello,<div>This is the approach I have followed till now:</div><div>I edited /etc/openldap/ldap.conf as follow:</div><div>TLS_REQCERT allow</div><div>after restarting of dirsrv and using Active directoy's CA file in --cacert switch it procceded making Sync agreement but failed to do update with this error:</div><div><br></div><div>NSMMReplicationPlugin - agmt="cn=meToad-sercer.local.dc" (ad-server:389) : Replication bind with SIMPLE auth failed: LDAP error -11 (connect error) (TLS error -8174:security library: bad database.)</div><div><br></div><div>slapi_ldap_bind - Error: could not send startTLS request: error -11 (connect error) errno 0 (Success)</div><div> </div><div>I would be glad if anyone could help me to resolve the error.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Sat, Oct 31, 2015 at 11:37 AM, mitra dehghan <span dir="ltr"><<a href="mailto:mitra.dehghan@gmail.com" target="_blank">mitra.dehghan@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Dear Rob,<div>Thanks for your response:</div><div><br></div><div><br></div><div><span style="font-size:12.8px">> Yes but which cert did you provider, the root CA </span><a href="http://contoso.com/" rel="noreferrer" style="font-size:12.8px" target="_blank">contoso.com</a><span style="font-size:12.8px"> or the</span><br style="font-size:12.8px"><span style="font-size:12.8px">subordinate CA local.dc?</span><br></div><div><span style="font-size:12.8px">Actually I was using active directory's certificate with --cacert switch in ipa-replica-manage</span></div><div><span style="font-size:12.8px">Thanks to info you gave me about NSS I changed the approach. </span></div><div><span style="font-size:12.8px">first: using certutil, I manually added root CA (<a href="http://contoso.com" target="_blank">contoso.com</a>) and subordinate(local.dc) certificates in /etc/dirsrv/slapd-REALM database</span><br></div><div><span style="font-size:12.8px"># certutil -A -d /etc/dirsrv/slapd-YOUR-REALM -n "</span><a href="http://contoso.com/" rel="noreferrer" style="font-size:12.8px" target="_blank">contoso.com</a><span style="font-size:12.8px"> CA" -t </span><span style="font-size:12.8px">CT,, -a -i /path/to/contoso.pem</span><br style="font-size:12.8px"><span style="font-size:12.8px"># certutil -A -d /etc/dirsrv/slapd-YOUR-REALM -n "local.dc CA" -t CT,, </span><span style="font-size:12.8px">-a -i /path/to/localdc.pem</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">then, following same approach, I added Active directory's certificate to the same db.</span></div><div><span style="font-size:12.8px"># certutil -A -d /etc/dirsrv/slapd-YOUR-REALM -n "active directory CA" -t ,, </span><span style="font-size:12.8px">-a -i /path/to/ad.cer</span><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">Note: since the original certificates were in .cer format and its same as .pem I just renamed certificates to .pem</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">Now my db has 5 certificates in:</span></div><div><span style="font-size:12.8px">a) root CA certificate (<a href="http://contoso.com" target="_blank">contoso.com</a>) </span></div><div><span style="font-size:12.8px">b) Subordinate CA (local.dc): issued to local.dc by <a href="http://contoso.com" target="_blank">contoso.com</a></span></div><div><span style="font-size:12.8px">c) Active directory CA (ad): issued to active directory by local.dc</span></div><div><span style="font-size:12.8px">d)IPA certificate:issued to IPA server by local.dc</span></div><div><span style="font-size:12.8px">e)localhost certificate: issued to localhost by IPA server 's internal CA.</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">finally I ran ipa-replica-manage:</span></div><div><span style="font-size:12.8px">- using <a href="http://contoso.com" target="_blank">contoso.com</a> CA in --cacert it says TLS error -8179: Peer's Certificate issuer is not recognized</span></div><div><span style="font-size:12.8px">-using local.dc CA in --cacert it says TLS error -8157: Certificate extension not found.</span></div><div><span style="font-size:12.8px">-using Active Directory CA in --cacert it says </span><span style="font-size:12.8px">TLS error -8179: Peer's Certificate issuer is not recognized</span></div><div><br></div><div> I would be glad if you help me more with this issue!</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Oct 30, 2015 at 5:17 PM, Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Please keep responses on the list<br> <br> mitra dehghan wrote:<br> > Thank you for your response.<br> > -First of all in section 15.5.1 of Red hat Enterprise Linux 6 Identity<br> > Management guide it says to copy both ad and IPA certificates in<br> > /etc/openldap/certs and i did the same. of course it worked when i was<br> > using internal CAs.<br> <br> Ok, it doesn't hurt anything, but for the purposes of ipa-replica-manage<br> it is a no-op.<br> <br> <br> > - I pass ad certificate in ipa-replica-manage command via --cacert switch.<br> <br> Yes but which cert did you provider, the root CA <a href="http://contoso.com" rel="noreferrer" target="_blank">contoso.com</a> or the<br> subordinate CA local.dc?<br> <br> > - After all I would be glad if you could give me more info about NSS<br> > database. Is that kind of substitute for /etc/openldap/certs? would you<br> > please give me more details about configurations needed for that?<br> <br> The crypto library that 389-ds uses is NSS. This uses a database to<br> store certificates and keys rather than discrete files. The certutil<br> tool is used to manage this file (there is a brief man page).<br> <br> ipa-replica-manage will add the AD cert to 389-ds for you, but you can<br> add certs manually and I think it might help in this case:<br> <br> # certutil -A -d /etc/dirsrc/slapd-YOUR-REALM -n "<a href="http://contoso.com" rel="noreferrer" target="_blank">contoso.com</a> CA" -t<br> CT,, -a -i /path/to/contoso.pem<br> # certutil -A -d /etc/dirsrc/slapd-YOUR-REALM -n "local.dc CA" -t CT,,<br> -a -i /path/to/localdc.pem<br> <br> The -n option specifies a "nickname" to use for the certificate. You can<br> use pretty much anything you want but being descriptive helps.<br> <br> rob<br> <br> ><br> ><br> ><br> > On Wed, Oct 28, 2015 at 5:20 PM, Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a><br> > <mailto:<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>>> wrote:<br> ><br> > mitra dehghan wrote:<br> > > hello,<br> > > I want to implement and IPA server and Sync it with my 2012 ms ad.<br> > While<br> > > things go well using an internal CA in each server, I came across kind<br> > > of problem when I want integrate solution with my PKI which is already<br> > > serving the AD server.<br> > > I can install IPA with --external-ca switch. but when it comes to<br> > Sync.<br> > > agreement it says "TLS error -8179:Peer's Certificate issuer is not<br> > > recognized."<br> > ><br> > > The architecture is:<br> > > - There is a root CA named <a href="http://contoso.com" rel="noreferrer" target="_blank">contoso.com</a> <<a href="http://contoso.com" rel="noreferrer" target="_blank">http://contoso.com</a>><br> > <<a href="http://contoso.com" rel="noreferrer" target="_blank">http://contoso.com</a>><br> > > - There is a subordinate CA named local.dc<br> > > - The certificates of AD and IPA server are both issued by local.dc<br> > > - IPA's certificate is issued based on the CSR file generated by<br> > > ipa-server-install<br> > > - I have copied both certificates in /etc/openldap/certs directory and<br> > > the rest was same as what i did in the internal CA scenario.<br> > ><br> > > while the FreeIPA docs say both servers must have internal CA's i need<br> > > to integrate solution with available PKI.<br> > > I would be glad hear suggestions if this scenario is applicable<br> > and what<br> > > is wrong there.<br> > > thank you<br> ><br> > 389-ds doesn't use /etc/openldap/certs.<br> ><br> > What cert are you passing in when creating the winsync agreement using<br> > ipa-replica-manage?<br> ><br> > You may need/want to add these certs to the IPA 389-ds NSS database<br> > prior to setting up the agreement.<br> ><br> > rob<br> ><br> ><br> ><br> <span><font color="#888888">><br> > --<br> > m-dehghan<br> <br><span class="HOEnZb"><font color="#888888"> </font></span></font></span></blockquote></div><span class="HOEnZb"><font color="#888888"><br></font></span></div><span class="HOEnZb"><font color="#888888"><br clear="all"><div><br></div>-- <br><div>m-dehghan</div> </font></span></blockquote></div><br></div><br clear="all"><div><br></div>-- <br><div class="gmail_signature">m-dehghan</div>